Quicksilver Forums Local File Include and Arbitrary File Upload Vulnerabilities
BID:32452
Info
Quicksilver Forums Local File Include and Arbitrary File Upload Vulnerabilities
| Bugtraq ID: | 32452 |
| Class: | Input Validation Error |
| CVE: |
CVE-2008-7064 |
| Remote: | Yes |
| Local: | No |
| Published: | Nov 24 2008 12:00AM |
| Updated: | May 07 2015 05:20PM |
| Credit: | __GiReX__ |
| Vulnerable: |
Quicksilver Forums Quicksilver Forums Portal 1.4.4 Quicksilver Forums Quicksilver Forums 1.4.2 PowerDNS Administrator PDNS-Admin 1.1.7 |
| Not Vulnerable: |
Quicksilver Forums Quicksilver Forums Portal 1.4.5 PowerDNS Administrator PDNS-Admin 1.1.8 |
Discussion
Quicksilver Forums Local File Include and Arbitrary File Upload Vulnerabilities
Quicksilver Forums is prone to a local file-include vulnerability and an arbitrary-file-upload vulnerability because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues to upload arbitrary files onto the webserver, execute arbitrary local files within the context of the webserver, and obtain sensitive information. By exploiting the arbitrary-file-upload and local file-include vulnerabilities at the same time, the attacker may be able to execute remote code.
Quicksilver Forums 1.4.2 is vulnerable; other versions may also be affected. Note that these issues affect only versions running on Windows platforms.
Quicksilver Forums is prone to a local file-include vulnerability and an arbitrary-file-upload vulnerability because the application fails to sufficiently sanitize user-supplied input.
An attacker can exploit these issues to upload arbitrary files onto the webserver, execute arbitrary local files within the context of the webserver, and obtain sensitive information. By exploiting the arbitrary-file-upload and local file-include vulnerabilities at the same time, the attacker may be able to execute remote code.
Quicksilver Forums 1.4.2 is vulnerable; other versions may also be affected. Note that these issues affect only versions running on Windows platforms.
Exploit / POC
Quicksilver Forums Local File Include and Arbitrary File Upload Vulnerabilities
An attacker can exploit these issues via a browser.
The following exploit code is available:
An attacker can exploit these issues via a browser.
The following exploit code is available:
Solution / Fix
Quicksilver Forums Local File Include and Arbitrary File Upload Vulnerabilities
Solution:
Updates are available. Please see the references for more information.
PowerDNS Administrator PDNS-Admin 1.1.7
Solution:
Updates are available. Please see the references for more information.
PowerDNS Administrator PDNS-Admin 1.1.7
-
PowerDNS Administrator PDNS-Admin
http://pdnsadmin.iguanadons.net/index.php?a=files&s=download&cid=2&fid =17
References
Quicksilver Forums Local File Include and Arbitrary File Upload Vulnerabilities
References:
References:
- PDNS-Admin 1.1.8 Released (PowerDNS Administrator)
- Quick Silver Forums Portal Security Update: QSF Portal 1.4.5 (Quick Silver Forums)
- QuickSilver Forums Homepage (Quicksilver Forums Development Team)